1. Technical Field
The present invention relates to packet data communications, and in particular, but not exclusively, to procedures, mechanisms and apparatus for the detection and mitigation of Denial of Service attacks in a public data communications network such as the Internet.
2. Related Art
Denial of Service attacks are designed to consume the resources of a network host or the network itself, thereby denying or at least degrading service to legitimate users. Denial of Service attacks are currently a difficult security problem to resolve because they are simple to implement, difficult to detect and very difficult to trace. Most work in this area has focused on tolerating attacks by mitigating their effects on the victim. Another option is to trace attacks back to the origin so they can be eliminated near the source.
Determining the source of an attack, known as the traceback problem, is extremely difficult due to the stateless nature of Internet routing. Attackers hide their location using incorrect or “spoofed” IP source addresses. As these packets traverse the Internet, the true origin is lost and the victim is left with no useful information as to the location of the attacker. One solution is to probabilistically send a tracing packet, called an “itrace” packet, with the traced packet at a forwarding router, as described in Bellovin: ICMP Traceback messages (“draft-bellovin-itrace-OO.txt”), AT&T Labs, March 2000.
When forwarding packets, routers which are itrace-enabled, generate with an extremely low probability a traceback message that is sent along in parallel with the data to the destination. With enough traceback messages from enough routers along the path, the traffic source and path can be determined by the host under attack.